Split it into modules and don't share the most important ones initially. Eg get them to do the infra at first, then user auth stuff, etc. Save your actual business logic for when you know and trust them more.

Ultimately your brand will be the most valuable thing, but if you don't have an established one I think it's fair enough to take precautions with someone you've never met and in a different jurisdiction.

I would expect a 'professional' to understand.